The plugin allows untrusted data to be deserialized using PHP serialization, creating a PHP Object Injection flaw. This weakness can be abused to execute arbitrary code or alter application state, resulting in full compromise of the affected WordPress site.

The vulnerability exists in CRM Perks Connector for Gravity Forms and Google Sheets, affecting all releases up through version 1.2.6 of the plugin.

The CVSS score of 9.8 indicates a critical level of severity. EPSS is reported as < 1 %, suggesting that widespread exploitation has not yet occurred, but the low probability does not mitigate the high impact potential. The plugin does not appear on the CISA KEV list. Based on the description, the likely attack vector is remote exploitation via a crafted HTTP request that triggers the vulnerable deserialization routine. An attacker who can influence the serialized payload can gain full control over the WordPress environment.